Auto-tuning security analysis tool configuration via correlation analysis

Abstract

A configuration for a security analysis tool is received from a user. The configuration includes two or more configuration items. Each configuration item is a parameter in the configuration of the security analysis tool that has a plurality of possible values. A correlation between the two or more configuration items is determined. The correlation is based on one or more pre-determined empirical correlations.

What is claimed is: 
     
       1. A method for automatically tuning a configuration of a security analysis tool based on a correlation analysis, the method comprising:
 receiving a configuration from a user for a security analysis tool, wherein the configuration includes two or more configuration items, and wherein each configuration item is a parameter, in the configuration of the security analysis tool, that has a plurality of possible values; and 
 determining, by one or more computer processors, a correlation between the two or more configuration items in the received configuration from the user, wherein:
 the correlation between the two or more configuration items is based on one or more pre-determined empirical correlations; 
 the one or more pre-determined empirical correlations are derived from an Apriori algorithm; 
 the Apriori algorithm generates correlations between two or more items of an input database; 
 the input database includes a plurality of configuration items (p) and a plurality of possible values (v) for each of the plurality of configuration items resulting in a database that ranges over all possible values of (p,v); 
 the Apriori algorithm performs a breadth-first search through all possible values of (p,v) that yields a set of association rules for the (p,v) pair combinations; and 
 the breadth-first search is an algorithm for searching graph data structures that starts at a root and explores neighbor nodes before moving to next level neighbors. 
 
 
     
     
       2. The method of  claim 1 , further comprising:
 providing an optimized configuration of the two or more configuration items in the received configuration to the user based on the determined correlation between the two or more configuration items in the received configuration. 
 
     
     
       3. The method of  claim 1 , further comprising:
 sending a query to the user requesting a priority of the two or more configuration items in the received configuration; 
 receiving an input from the user indicating the priority of the two or more configuration items in the received; and 
 sending a recommendation to the user, wherein the recommendation includes one or more configuration item values for each configuration item of the two or more configuration items based on the pre-determined empirical correlations and the indicated priority of the two or more configuration items. 
 
     
     
       4. The method of  claim 1 , wherein each configuration item is selected from the group consisting of: case sensitive uniform resource locators (URLs), in-session detection, automatic form fill requirements, parameters and paths being tracked. 
     
     
       5. The method of  claim 1 , wherein the security analysis tool is used to analyze an Internet application for security vulnerabilities during development of the Internet application. 
     
     
       6. A computer program product for automatically tuning a configuration of a security analysis tool based on a correlation analysis, the computer program product comprising:
 one or more computer readable storage media; and 
 program instructions stored on the one or more computer readable storage media, the program instructions comprising:
 program instructions to receive a configuration from a user for a security analysis tool, wherein the configuration includes two or more configuration items, and wherein each configuration item is a parameter, in the configuration of the security analysis tool, that has a plurality of possible values; and 
 program instructions to determine a correlation between the two or more configuration items in the received configuration from the user, wherein:
 the correlation between the two or more configuration items is based on one or more pre-determined empirical correlations; 
 the one or more pre-determined empirical correlations are derived from an Apriori algorithm; 
 the Apriori algorithm generates correlations between two or more items of an input database; 
 the input database includes a plurality of configuration items (p) and a plurality of possible values (v) for each of the plurality of configuration items resulting in a database that ranges over all possible values of (p,v); 
 the Apriori algorithm performs a breadth-first search through all possible values of (p,v) that yields a set of association rules for the (p,v) pair combinations; and 
 the breadth-first search is an algorithm for searching graph data structures that starts at a root and explores neighbor nodes before moving to next level neighbors. 
 
 
 
     
     
       7. The computer program product of  claim 6 , further comprising program instructions stored on the one or more computer readable storage media, to:
 provide an optimized configuration of the two or more configuration items in the received configuration to the user based on the determined correlation between the two or more configuration items in the received configuration. 
 
     
     
       8. The computer program product of  claim 6 , further comprising program instructions stored on the one or more computer readable storage media, to:
 send a query to the user requesting a priority of the two or more configuration items in the received configuration; 
 receive an input from the user indicating the priority of the two or more configuration items in the received; and 
 send a recommendation to the user, wherein the recommendation includes one or more configuration item values for each configuration item of the two or more configuration items based on the pre-determined empirical correlations and the indicated priority of the two or more configuration items. 
 
     
     
       9. The computer program product of  claim 6 , wherein each configuration item is selected from the group consisting of: case sensitive uniform resource locators (URLs), in-session detection, automatic form fill requirements, parameters and paths being tracked. 
     
     
       10. The computer program product of  claim 6 , wherein the security analysis tool is used to analyze an Internet application for security vulnerabilities during development of the Internet application. 
     
     
       11. A computer system for automatically tuning a configuration of a security analysis tool based on a correlation analysis, the computer system comprising:
 one or more computer processors; 
 one or more computer readable storage media; and 
 program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
 program instructions to receive a configuration from a user for a security analysis tool, wherein the configuration includes two or more configuration items, and wherein each configuration item is a parameter, in the configuration of the security analysis tool, that has a plurality of possible values; and 
 program instructions to determine a correlation between the two or more configuration items in the received configuration from the user, wherein:
 the correlation between the two or more configuration items is based on one or more pre-determined empirical correlations; 
 the one or more pre-determined empirical correlations are derived from an Apriori algorithm; 
 the Apriori algorithm generates correlations between two or more items of an input database; 
 the input database includes a plurality of configuration items (p) and a plurality of possible values (v) for each of the plurality of configuration items resulting in a database that ranges over all possible values of (p,v); 
 the Apriori algorithm performs a breadth-first search through all possible values of (p,v) that yields a set of association rules for the (p,v) pair combinations; and 
 the breadth-first search is an algorithm for searching graph data structures that starts at a root and explores neighbor nodes before moving to next level neighbors. 
 
 
 
     
     
       12. The computer system of  claim 11 , further comprising program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, to:
 provide an optimized configuration of the two or more configuration items in the received configuration to the user based on the determined correlation between the two or more configuration items in the received configuration. 
 
     
     
       13. The computer system of  claim 11 , further comprising program instructions stored on the one or more computer readable storage media, to:
 send a query to the user requesting a priority of the two or more configuration items in the received configuration; 
 receive an input from the user indicating the priority of the two or more configuration items in the received; and 
 send a recommendation to the user, wherein the recommendation includes one or more configuration item values for each configuration item of the two or more configuration items based on the pre-determined empirical correlations and the indicated priority of the two or more configuration items. 
 
     
     
       14. The computer system  claim 11 , wherein each configuration item is selected from the group consisting of: case sensitive uniform resource locators (URLs), in-session detection, automatic form fill requirements, parameters and paths being tracked.